Finding
The active security model treats power/volume/PTT gestures as control inputs, including a PTT triple-click panic path, but the production tree has no source-grounded side-button GPIO/event producer. PttTripleClick exists as a policy enum/test input only. #880 is deliberately scoped to the front keypad matrix and #753 to later service-loop delivery, so neither owns the side-button contract.
Evidence
crates/thumos/src/security_mode.rs presents star+hash+power, PTT triple-click, and duress as panic activation paths, but production search finds no PTT input producer.- The PTT variant is constructed only in policy/test surfaces; no board adapter maps a physical PTT event.
- Kanon Phase 08 planning asks about power/volume GPIOs while hardware/principles docs use PTT as a Covert/Sentinel/Panic control without an accepted board source.
Why this matters
A security-critical gesture that exists only as an injectable enum can be reported as implemented while no physical event can reach it. Guessing side-button pins, polarity, debounce, or multi-click timing risks unsafe GPIO access and accidental destructive actions. This is source/software work before an M7 receipt.
Done when
- Pin authoritative AGM M7/MT6739 evidence for each in-scope side button/PTT signal, pinmux/controller semantics, polarity, debounce, and electrical behavior.
- Device builds fail closed with the adapter disabled until the board profile is accepted.
- A bounded input adapter emits explicit side-button events into one production path; tests cover unavailable/stuck/bouncing lines, simultaneous buttons, timing boundaries, and event loss.
- Panic/covert gestures use authenticated policy with explicit confirmation/abort behavior; no uncalibrated or ambiguous gesture autonomously triggers destructive action.
- Kanon Phase 08/11 acceptance and UI/audit wording distinguish represented policy events from independently observed physical input.
- Only after software/source acceptance may an operator-owned M7 side-button receipt run.
Finding
The active security model treats power/volume/PTT gestures as control inputs, including a PTT triple-click panic path, but the production tree has no source-grounded side-button GPIO/event producer.
PttTripleClickexists as a policy enum/test input only. #880 is deliberately scoped to the front keypad matrix and #753 to later service-loop delivery, so neither owns the side-button contract.Evidence
crates/thumos/src/security_mode.rspresents star+hash+power, PTT triple-click, and duress as panic activation paths, but production search finds no PTT input producer.Why this matters
A security-critical gesture that exists only as an injectable enum can be reported as implemented while no physical event can reach it. Guessing side-button pins, polarity, debounce, or multi-click timing risks unsafe GPIO access and accidental destructive actions. This is source/software work before an M7 receipt.
Done when